Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    31/08/2024, 11:11 UTC

General

  • Target

    212068494b9a5e0238568a842da660da.exe

  • Size

    971KB

  • MD5

    212068494b9a5e0238568a842da660da

  • SHA1

    880afab8133a3b62a4e1d87f94bcef846846f024

  • SHA256

    6046803acf690fbb6e646be03c4a59201fe1a96b8791dd4bf8d2bc4c7eeb7d32

  • SHA512

    afd63a289f8c1a5ac2b1ade03c6db1f5a6cc6efa8ddc8c33a7559c699d97df09a00cfff87d366065f39a13643efe0e37bf0049a021c4ec51e27b91f30d6dcaf1

  • SSDEEP

    24576:dBrYKjLhvej6aV9b7w6tt6nWHdCgjuf+lBqA:dZLh+6ac6ttfH3KSq

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

103.161.133.245:9898

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-LN5NIY

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Detected Nirsoft tools 8 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 3 IoCs

    Password recovery tool for various web browsers

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\212068494b9a5e0238568a842da660da.exe
    "C:\Users\Admin\AppData\Local\Temp\212068494b9a5e0238568a842da660da.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2524
    • C:\Users\Admin\AppData\Local\Temp\212068494b9a5e0238568a842da660da.exe
      "C:\Users\Admin\AppData\Local\Temp\212068494b9a5e0238568a842da660da.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2512
      • C:\Users\Admin\AppData\Local\Temp\212068494b9a5e0238568a842da660da.exe
        C:\Users\Admin\AppData\Local\Temp\212068494b9a5e0238568a842da660da.exe /stext "C:\Users\Admin\AppData\Local\Temp\npfenuetnab"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2704
      • C:\Users\Admin\AppData\Local\Temp\212068494b9a5e0238568a842da660da.exe
        C:\Users\Admin\AppData\Local\Temp\212068494b9a5e0238568a842da660da.exe /stext "C:\Users\Admin\AppData\Local\Temp\xsswgfpubitjnz"
        3⤵
        • Accesses Microsoft Outlook accounts
        • System Location Discovery: System Language Discovery
        PID:2956
      • C:\Users\Admin\AppData\Local\Temp\212068494b9a5e0238568a842da660da.exe
        C:\Users\Admin\AppData\Local\Temp\212068494b9a5e0238568a842da660da.exe /stext "C:\Users\Admin\AppData\Local\Temp\imxphxioxqloyfhes"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2724

Network

  • flag-us
    DNS
    geoplugin.net
    212068494b9a5e0238568a842da660da.exe
    Remote address:
    8.8.8.8:53
    Request
    geoplugin.net
    IN A
    Response
    geoplugin.net
    IN A
    178.237.33.50
  • flag-nl
    GET
    http://geoplugin.net/json.gp
    212068494b9a5e0238568a842da660da.exe
    Remote address:
    178.237.33.50:80
    Request
    GET /json.gp HTTP/1.1
    Host: geoplugin.net
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    date: Sat, 31 Aug 2024 11:11:20 GMT
    server: Apache
    content-length: 955
    content-type: application/json; charset=utf-8
    cache-control: public, max-age=300
    access-control-allow-origin: *
  • 103.161.133.245:9898
    212068494b9a5e0238568a842da660da.exe
    2.5kB
    771 B
    11
    15
  • 103.161.133.245:9898
    212068494b9a5e0238568a842da660da.exe
    30.7kB
    510.6kB
    203
    372
  • 178.237.33.50:80
    http://geoplugin.net/json.gp
    http
    212068494b9a5e0238568a842da660da.exe
    623 B
    2.5kB
    12
    4

    HTTP Request

    GET http://geoplugin.net/json.gp

    HTTP Response

    200
  • 8.8.8.8:53
    geoplugin.net
    dns
    212068494b9a5e0238568a842da660da.exe
    59 B
    75 B
    1
    1

    DNS Request

    geoplugin.net

    DNS Response

    178.237.33.50

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\npfenuetnab

    Filesize

    2B

    MD5

    f3b25701fe362ec84616a93a45ce9998

    SHA1

    d62636d8caec13f04e28442a0a6fa1afeb024bbb

    SHA256

    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

    SHA512

    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

  • memory/2512-61-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-66-0x0000000010000000-0x0000000010019000-memory.dmp

    Filesize

    100KB

  • memory/2512-78-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-77-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-76-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-75-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-74-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-9-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-20-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-22-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-23-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-73-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-25-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-26-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-17-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-16-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-15-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-12-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-14-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-13-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-10-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2512-27-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-28-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-30-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-29-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-32-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-72-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-71-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-70-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-69-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-67-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2512-65-0x0000000010000000-0x0000000010019000-memory.dmp

    Filesize

    100KB

  • memory/2512-62-0x0000000010000000-0x0000000010019000-memory.dmp

    Filesize

    100KB

  • memory/2524-1-0x0000000000AC0000-0x0000000000BB8000-memory.dmp

    Filesize

    992KB

  • memory/2524-3-0x0000000005060000-0x0000000005148000-memory.dmp

    Filesize

    928KB

  • memory/2524-4-0x00000000003E0000-0x00000000003F8000-memory.dmp

    Filesize

    96KB

  • memory/2524-5-0x00000000747AE000-0x00000000747AF000-memory.dmp

    Filesize

    4KB

  • memory/2524-6-0x00000000747A0000-0x0000000074E8E000-memory.dmp

    Filesize

    6.9MB

  • memory/2524-24-0x00000000747A0000-0x0000000074E8E000-memory.dmp

    Filesize

    6.9MB

  • memory/2524-0-0x00000000747AE000-0x00000000747AF000-memory.dmp

    Filesize

    4KB

  • memory/2524-2-0x00000000747A0000-0x0000000074E8E000-memory.dmp

    Filesize

    6.9MB

  • memory/2524-7-0x0000000005250000-0x0000000005310000-memory.dmp

    Filesize

    768KB

  • memory/2704-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2704-36-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2704-47-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2704-52-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2704-37-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2704-59-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/2724-48-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/2724-49-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/2724-45-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/2724-46-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/2724-41-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2724-43-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/2956-68-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/2956-40-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/2956-51-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/2956-54-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/2956-38-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2956-53-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.